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^! Abstract 

^j. I We propose a quantum key distribution sclieme that combines a biased basis choice with the 

decoy-state method. In this scheme, Alice sends all signal states in the Z basis and decoy states 

i-Q . in the X and Z basis with certain probabilities, and Bob measures received pulses with optimal 

P-c 



basis choice. This scheme simplifies the system and reduces the random number consumption. 
From the simulation result taking into account of statistical fluctuations, we find that in a typical 
experimental setup, the proposed scheme can increase the key rate by at least 45% comparing to 
the standard decoy-state scheme. In the postprocessing, we also apply a rigorous method to upper 
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^^ I bound the phase error rate of the single-photon components of signal states. 

m 
in 

o 
en 



X 



' |yhweizhengchao@gniail.com 



^ |wlwangl988@ginail.coin| 
■l- |zzhangl2@mails. tsinghua. edu.cn| 



xina@tsinghua.edu. cn| 



Quantum key distribution (QKD) [1, 2] is one of the most realistic applications in quan- 
tum information. It aims at extending a secret key between two distant parties, commonly 
noted as Alice and Bob. The unconditional security has been proven even when an eaves- 

nn 

dropper, Eve, has unlimited computation power permitted by quantum mechanics (3l-l6l|. 

The best known protocol of QKD is the BB84 protocol [l| presented by Bennett and 
Brassard in 1984. In BB84, Alice encodes the key information randomly into the X and 
Z bases and sends quantum pulses to Bob. Bob measures the received pulses in two bases 
randomly. After that, they compare the basis through an authenticated classical channel. 
The key can only be extracted from the pulses where they use the same basis and this results 
in that on average half of the raw data is discarded. That is, the basis-sift factor is 1/2 in the 
original BB84 protocol. This factor can be improved by the efficient BB84 scheme proposed 
by Lo et al. [7|. In the efficient scheme, Alice and Bob put a bias in the probabilities of 
choosing the Z basis and X basis, which can make the basis sift-factor close to 100% in the 
infinitely long key limit. The efficient BB84 scheme is experimentally demonstrated in 2009 



In practical QKD systems, a highly attenuated laser or a weak coherent state source is 
widely used to substitute for a perfect single-photon source which is beyond state-of-the-art 
technology. A weak coherent state source contains multi-photon components (details shown 
in Appendix lAl) . When multi-photon states are used for QKD, Eve can launch attacks, like 
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the photon-number-splitting (PNS) attack [9|, |10|, to break the security. Since Eve could 
have a full control of the quantum channel, she can make the transmittance of multi-photon 
states to be 100% in the PNS attack. In a conventional security analysis [11|, Alice and 
Bob have to assume all the losses and errors come from the single-photon components in 
the worst scenario case. As a result, the performance of QKD is very poor. To improve 
;he performance of the weak coherent state QKD, Hwang proposed the decoy-state method 
12( 1 . Instead of sending one coherent state, Alice sends pulses with different intensities, so 
that she can obtain more information to monitor the quantum channel. To maintain the 
detection statistics of coherent states with different intensities. Eve is not able to change the 
transmittances of single-photon and multi-photon state freely without being noticed by Alice 



and Bob. The security of the decoy-state method is proven 13|, along with various practical 
schemes \l% ll5| . Follow-up experimental demonstrations show that the decoy-state method 



is a very effective way to improve QKD performance 16|-|20|. 



Naturally, we can improve the decoy-state method by applying the biased-basis idea of the 
efficient BB84 protocol. There are a few observations. First, Alice does not need to choose 
basis when she chooses the vacuum decoy state. Second, if Alice and Bob mainly choose one 
basis, say Z basis, for key generation, they effectively treat X basis as for quantum channel 
testing. In this sense, the functionality of X basis is similar to the decoy states. Intuitively, 
one may expect to combine decoy states and X basis together. 

Here, we propose a new decoy-state method with biased basis choice, following the widely 
used decoy-state scheme, vacuum+weak decoy-state method [l5| (a quick review is shown 
in Appendix [C|) . where Alice sends out pulses with three different intensities, vacuum (with 
an intensity of 0), weak decoy (with an intensity of v) and signal (with an intensity of /i) 
states. 

1. Alice prepares all the signal pulses (/x) in the Z basis, where the final secure key is 
extracted from. 

2. She prepares weak decoy pulses [y] in the X and Z with certain probabihties. 

3. If she chooses the vacuum decoy state, she does not need to set any basis. 

4. Bob measures the received pulses in the X basis and Z basis with probabilities p^, and 
P2, respectively. 

The scheme is summarized in Table [B In the new scheme, only 4 sets of preparations are 
used by Alice. Compared to the original vacuum+weak decoy-state method, where 6 sets 
are used, the proposed scheme can simplify the system and reduce the cost of random 
numbers. Later in the simulation, we will show that this scheme can also improve the QKD 
performance. 
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Following the GLLP security analysis [11|, the key generation rate is given by |13l.l21| 



R > q{-Iec + Qi[l - ^(ef )] + Qo}, 

Iec = fQ,H{E^), (1) 



'i- ^r ' 



Ntotal 

where q is the raw data sift factor, including basis-sift factor and signal-state ratio; lec is the 
cost of error correction and the rest terms in the bracket is the rate of privacy amplification; 



TABLE I. List of Alice and Bob's operations. Alice prepares and sends Ntotai pulses, with Nt^iai 
Nfj, + Nj; + N^ + A'^o- Bob measures the received pulses with certain probabilities, Pz + Px = 1- 



Alice prepares and sends 


Bob measures 


Nfj, signal pulses in the Z basis 




N^ decoy pulses in the Z basis 


with probability pz in the Z basis 


Nj^ decoy pulses in the X basis 


with probability Px in the X basis 


No vacuum pulses 





/ is the error correction inefficiency; Q^ and E^ are the overall gain and quantum bit error 
rate (QBER); Qf is the gain of the single-photon components and e^^ is its corresponding 
phase error rate; Qo is the background gain; H{x) = — xlog2(x) — (1 — x) log2(l — x) is the 
binary Shannon entropy function. Note that in our scheme, the final key is extracted from 
Z-basis measurement results, so all the variables in Eq. ([T]) should be measured in the Z 
basis. The phase error rate e^*^ cannot be measured directly, which, instead, can be inferred 
from the error rate in the X basis [22]. 

The gain and QBER, Q^ and E^, can be measured from the experiment directly. Alice and 
Bob need to estimate Ql and e{^ for privacy amplification. According to the model reviewed 
in Appendix lAl we have Ql = Y^fie~'^ and Qo = Yqc'^, where Y-l and Yq are the yield of 
single-photon components measured in the Z basis and background rate, respectively. In 
order to lower bound the key rate Eq. ([1]), one can lower bound F/, Yq and upper bound 






Since that both the vacuum state and the single-photon state are basis independent, the 
yields of vacuum states and single-photon states in different bases are equal 

° "• (2) 

Y^ = Y{. 

While a multi-photon state is basis dependent, so for any i-photon state (i > 2), in general, 

Yr + y^. (3) 

As for the error rates, the phase error probability in the Z basis equals to the bit error 
probability in the X basis 

ef = e?^ (4) 



Then, in the finite-key-size situation where statistical fluctuations should be taken into 



account 
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23J . we have 



ef ^ e\\ (5) 



Given e^^, we can upper bound ef^ by the random sampling argument (details shown in 
Appendix [B]). We need to point out that even though the single-photon state is basis inde- 
pendent, the error rates in two basis may not be the same 

el^el. (6) 

This can be easily seen by considering a simple intercept-and-resend attack where Eve mea- 
sures all the pulses in the Z basis, and then she will not introduce any additional error in 
the Z basis e^ = 0, but e^ = 1/2. 

In our simulation, the parameters of the experimental setup are listed in Table [TTl 
Statistical fluctuations are taken into account in the simulation (details shown in Appendix 

TABLE II. List of experimental parameters for simulation. 



Ntotal f Gd Yq 

6 X 10^ 1.16 3.3% 1.7 X 10^6 

iDl) . We compare the key generation rate in our scheme with that in the standard BB84 
protocol with the vacuum+weak decoy-state scheme. The result is shown in Fig. [TJ 

In Fig. [H the key rate of the proposed biased scheme is larger than that of the standard 
BB84 with vacuum+weak decoy states by at least 45%. When the transmission loss is 
0, the key rate improvement can go up to 80%. As the transmission loss increases, the 
improvement of the biased scheme decreases. This is because at a larger transmission loss, 
more pulses for decoy states are needed and Bob also needs a larger px to estimate the 
privacy ampliflcation part in Eq. ([1]). The improvement comes from the fact that Px is 
less than 1/2. As p^ approaches to 1/2, the biased scheme becomes similar to the original 
scheme, where px = Pz = 1/2. 

For a practical QKD system, one needs to optimize the bias px for the key rate. The 
dependence of the optimal bias on the transmission loss is shown in Fig. [2l from which we 
can see that the optimal p^ is about 0.95 when the transmission loss is below 3 dB and 
decreases as the transmission loss increases. The minimal optimal Pz is about 0.6, which is 
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FIG. 1. (Color online) Plot of key rate versus total transmittance. The solid line shows the result 
of our scheme and the red line shows the result of the standard BB84 with the vacuuni+weak 
decoy-state method. The simulation parameters are shown in Table [III The confidence interval for 
statistical fluctuation is 5 standard deviations (i.e., 1 — 5.73 x 10^^). The expected photon number 
of signal state /i is 0.479. For each transmission loss, we optimize all the parameters, z^, A'^, N^, 
N^, No, pz, and Pi,. 



close to 1/2. That is why our scheme approaches the standard BB84 with the vacuum+weak 
decoy-state scheme as the transmission loss increases. 



In conclusion, we combine the decoy-state QKD with a biased basis choice to enhance the 
system performance. The key point of our scheme is increasing the raw data sift factor by 
setting all signal states in one (Z) basis. We take statistical fluctuations into account and use 
a rigorous method to upper bound the phase error rate of the single-photon components of 
the signal state. Comparing the result with that in the standard decoy-state BB84 protocol, 
we find an improvement in the key generation rate. Meanwhile, we reduce the complexity 
of the QKD system by assigning all signal states in the Z basis. 
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FIG. 2. Plot of optimal Pz versus transmission loss. 
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Appendix A: Model 



Here, we follow the model in Ref. 15|. The weak coherent state source is equivalent to a 
photon-number channel model and its photon number follows a Poisson distribution: 



Pin) 



n\ 



(Al) 



Define Yi as the yield of an i-photon state; rj as the transmittance of the channel measured 
in dB] Yo as the background count rate. Then, in a normal channel when there is no Eve's 
intervention, Yi is given by: 

y, = l-(l-Fo)(l-^)^ (A2) 



The gain of i-photon states Qi is given by: 

Q^ = Y^^e-^. (A3) 

The overall gain which means the probability for Bob to obtain a detection event in one 
pulse with intensity /i is : 

OO OO j 

^M = E^^ = E^4^"'- (A4) 



i=0 i=0 

The error rate of i-photon states Cj is given by 



e,Y, = eoYo + e^l - (1 - r/)'](l - Fo), (A5) 

where e^ is the probability that a photon hits the erroneous detector and cq = 1/2. The 
overall QBER is given by 

OO ; 



E,Q, = Y,(^^Y,^e-^. (A6) 

j=0 

Without Eve changing Yi and e,, the gain and QBER are given by 



Q^ = l-e-^'^(l-yo), 
E^Q^ = eoFo + erf(l - e-'"^)(l - Fq) 



(A7) 



pz 



Appendix B: Upper bound of e^ 

Here, we review the random sampling argument: using the bit error rate measured in the 
X basis, ej^', to estimate the phase error rate in the Z basis, ef^, for privacy amplification. 



Details of derivation can be found in Ref. 



23|. 



If the key size is infinite, we know that ej^ = e\^ . Otherwise, given ej^, Ux (the number 
of decoy states that Alice sends and Bob measures in the X basis), and Hz (the number of 
signal states that Alice sends and Bob measures in the Z basis), we can give a probabilistic 
upper bound of e{^ such that it is lower than e\^ with a small probability Pbx 

Pex = Pr{epz > e,,. + 6^}, (Bl) 

where 6^ is the deviation of the phase error rate from the tested value. Here, P^. is a 



controllable variable and is equal to 10 in the simulation. From 



>/ete(l - ebx)n^.n. 



VX'l'Z 
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where the function ^xi^x) is given by 

^x{Ox) = H{ebx + Ox - qxOx) - qxH{ebx) - (1 - qx)H{ebx + Ox), (B3) 

and Qx = Ux/iux + fiz). Given Pqx, we compute the value of C,x and find the value Ox which 
is the root of Eq. (]B3|) . We get the probabilistic upper bound 

ef^ = e,x + Ox. (B4) 

Appendix C: Vacuum+weak decoy state 

In this protocol, Alice and Bob use two decoy states to estimate the low bound of Yi 
and the upper bound of ei. First, they implement a vacuum decoy state to estimate the 
background counts in signal states 

^vacuum -'0; 

_ 1 (CI) 

E^acuum = eo = 2- 

Secondly, they perform a weak decoy state where Alice uses a weaker intensity u {u < ii) 
for the decoy state to estimate Yi and Ci. We have: 

n > n^ = -^^ f Q.e^ - Q.e^4 - ^^^A ' (C2) 



and 



^ E^Q^e" - eoYo 



e, < e- = -- - . (C3) 

-'1 ^ 

Note that in our scheme all the parameters for estimating Y^ are measured in the Z 
basis and the parameters for estimating e^ are measured in the X basis. And we must lower 

n 

bound Yq to obtain the lower bound of the key rate[15|]. The ef we get here will substitute 
ebx in Eq. ^. 

Appendix D: Statistical fluctuation 



Here, we consider statistical fluctuations for the decoy-sate method, following Ref. 15| 
We need to modify the estimation of Yi, Eq. (IC2p . and ei, Eq. (ICSp . 



The total number of pulses sent by Alice is composed of four cases 

Ntotai = N, + Nt + N: + No. (Dl) 

Since that Alice sends all signal states in the Z basis and the final key is only extracted 
from the data measured in the Z basis, the parameter q in Eq. ([T]) is given by 

. = 1^. (D2) 

^^ total 



We follow the statistical fluctuation analysis proposed in Ref. |24| 

Q^u = 4(1 - 



yjNSv^Q^" (D3) 

where Qm' Qi^ ^"^^ ^o a-re measurement outcomes which means that they are rates instead 
of probabilities. If we follow the standard error analysis assumption, Ua is the number of 
standard deviations one chooses for the statistical fluctuation analysis. Note that Q^ and 
Q^ are used to estimate Y^" , so they should be measured in the Z basis. Here we use 
Eq. (]B1|) to estimate the upper bound of e^^ with 

(D4) 
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